New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 741034 link

Starred by 3 users
Status: Verified
Owner:
█ hubbe@chromium.org
Last visit > 30 days ago
Closed: Nov 2017
Cc:
█ alevi...@aracnet.com
etienneb@chromium.org
█ msrchandra@chromium.org
█ jamr...@gmail.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in ff_gen_search

Project Member Reported by ClusterFuzz, Jul 11 2017 
Detailed report: https://clusterfuzz.com/testcase?key=4621906459492352

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  ff_gen_search
  ff_seek_frame_binary
  av_seek_frame
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=447011:447110

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4621906459492352


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Comment 1 by sandeepkumars@chromium.org, Jul 13 2017

Cc: msrchandra@chromium.org di...@biurrun.de
Components: Infra>Git
Labels: M-61 Test-Predator-Correct-CLs
Assigning to concern owner from Predator results --
Regression information is not available. The result is the blame information.

Author: Diego Biurrun
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/50ecf15712354a1d5b3f4dc9a57ff90ed7ee9654
Time: Thu Jan 16 00:53:03 2014
The CL last changed line 2259 of file utils.c, which is stack frame 0. 

Author: Diego Biurrun
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/50ecf15712354a1d5b3f4dc9a57ff90ed7ee9654
Time: Thu Jan 16 00:53:03 2014
The CL last changed line 2156 of file utils.c, which is stack frame 1. 

Author: Nicolas George
Project: chromium-ffmpeg
Changelist: https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/cc24afb45cfda95eda91ae8dbdfaa26aa35acc36
Time: Mon Apr 29 21:58:22 2013
The CL last changed line 2461 of file utils.c, which is stack frame 2. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ecb1b24070b8cbf7958f05ecad9373b979e212b9
Time: Tue Mar 21 07:25:54 2017
The CL last changed line 91 of file callback.h, which is stack frame 3. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/6e42784f92a0b66a3eae584358ec4a8778bffa33
Time: Wed Apr 05 10:13:21 2017
The CL last changed line 20 of file post_task_and_reply_with_result_internal.h, which is stack frame 4. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/99de02ba952b0a69291f81c5b8ca14d81cc1f74f
Time: Fri Jul 01 05:54:12 2016
The CL last changed line 164 of file bind_internal.h, which is stack frame 5. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ecb1b24070b8cbf7958f05ecad9373b979e212b9
Time: Tue Mar 21 07:25:54 2017
The CL last changed line 91 of file callback.h, which is stack frame 6.

@henrike -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You

Comment 2 by sandeepkumars@chromium.org, Jul 13 2017

Cc: -di...@biurrun.de
Owner: tzik@chromium.org
Status: Assigned (was: Untriaged)
Correction
=========

@tzik -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 3 by tzik@chromium.org, Jul 17 2017

Labels: -Test-Predator-Correct-CLs Test-Predator-Wrong QA-Triage-Wrong
Owner: ----
Status: Untriaged (was: Assigned)

Comment 4 by msrchandra@chromium.org, Sep 19 2017

Cc: alevi...@aracnet.com jamr...@gmail.com
Labels: CF-NeedsTriage
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "utils.c" adding the concern owner in Cc. Could some one please look into the issue and update.

Suspecting Commit#
https://chromium.googlesource.com/chromium/third_party/ffmpeg.git/+/b9d2005ea5d6837917a69bc2b8e98f5695f54e39

Thank You.

Comment 5 by msrchandra@chromium.org, Sep 19 2017

Cc: etienneb@chromium.org
 Issue 731596  has been merged into this issue.

Comment 6 by msrchandra@chromium.org, Sep 19 2017 

 Issue 719136  has been merged into this issue.
Project Member

Comment 7 by ClusterFuzz, Oct 1 2017

Components: Internals>Core
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 8 by manoranj...@chromium.org, Oct 3 2017

Labels: -CF-NeedsTriage
Owner: hubbe@chromium.org
Status: Assigned (was: Untriaged)
Here is the Change Log from CF report:
https://chromium.googlesource.com/chromium/src/+log/933415de4dc11b5f983ba3f48ea5d85e42d814f8..dde7b8ed7dc85fb9a8572b1612f7c5912e7755e7?pretty=fuller&n=10000

hubbe@, can you please take a look and see if something is related to your change (https://chromium.googlesource.com/chromium/src/+/4f79aee08df8f4521a9d5e39144b822739ea3888) ?

Thank you!

Comment 9 by mmoroz@chromium.org, Oct 24 2017 

For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md.

The link referenced in the description is no longer valid.

(bulk edit)

Comment 10 by mbarbe...@chromium.org, Nov 7 2017

Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Project Member

Comment 11 by ClusterFuzz, Nov 19 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5237199506505728 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by ClusterFuzz, Nov 26 2017

Labels: Needs-Feedback
ClusterFuzz testcase 4621906459492352 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
►

Sign in to add a comment